




<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  

<title>Linux code injection paint-by-numbers.  Can we launch a pro…</title>
<meta name="description" content='Linux code injection paint-by-numbers.  Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).  Firstly, how are processes created and what does related auditing look like?' />

<link rel="canonical" href="https://buzzchronicles.com/b/internet/7795/" />

<!-- Facebook OpenGraph developers.facebook.com/docs/reference/opengraph/ -->
<meta property="og:type" content="article">
<meta property="og:title"
  content="Linux code injection paint-by-numbers.&lt;br/&gt;&lt;br/&gt;Can we laun…">
<meta property="og:description" content='Tweets Collection related to: "Linux code injection paint-by-numbers.&lt;br/&gt;&lt;br/&gt;Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).&lt;br/&gt;&lt;br/&gt;Firstly, how are processes created and what does related auditing look like?"' />

  <meta property="og:image" content="https://buzzchronicles.com/static/stories/collection_pics/7795.png">
  
  <!-- Twitter domain approval dev.twitter.com/docs/cards/validation/validator -->
  <!-- For twitter, content is usually summary_large_image as shown -->
  <meta name="twitter:card" content="summary_large_image">
  <meta name="twitter:title"
    content="Linux code injection paint-by-numbers.&lt;br/&gt;&lt;br/&gt;Can we laun…">
  <meta name="twitter:description" content='Tweets Collection related to: "Linux code injection paint-by-numbers.&lt;br/&gt;&lt;br/&gt;Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).&lt;br/&gt;&lt;br/&gt;Firstly, how are processes created and what does related auditing look like?"' />
  
    <meta name="twitter:image" content="http://buzzchronicles.com/static/stories/collection_pics/7795.png">
    
    
  <meta name="author" content="Buzz Chronicles" />
  <meta name="keywords"
    content="twitter, similar, thread, threads, tweets, tweet, social, media, discussions, media, post, recommendation, news, article" />

  <!-- styles -->
  <link href="https://fonts.googleapis.com/css?family=Droid+Serif:400,600,400italic|Open+Sans:300" rel="stylesheet">
  <link href="/static/stories/assets/css/bootstrap.css?v=1.5" rel="stylesheet">
  <link href="/static/stories/assets/css/bootstrap-responsive.css?v=1.5" rel="stylesheet">
  <!--<link href="/static/stories/assets/js/google-code-prettify/prettify.css" rel="stylesheet">-->
  <link href="/static/stories/assets/css/style.css?v=1.5" rel="stylesheet">
  <link href="/static/stories/assets/color/default.css?v=1.5" rel="stylesheet">


  <!-- fav and touch icons -->
  <link rel="icon" href="/static/stories/assets/img/round_32x32.png" sizes="32x32">
  <link rel="icon" href="/static/stories/assets/img/round_192x192.png" sizes="192x192">

  <!-- Google Tag Manager -->
  <script>(function (w, d, s, l, i) {
      w[l] = w[l] || []; w[l].push({
        'gtm.start':
          new Date().getTime(), event: 'gtm.js'
      }); var f = d.getElementsByTagName(s)[0],
        j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : ''; j.async = true; j.src =
          'https://www.googletagmanager.com/gtm.js?id=' + i + dl; f.parentNode.insertBefore(j, f);
    })(window, document, 'script', 'dataLayer', 'GTM-TDQN47K');</script>
  <!-- End Google Tag Manager -->

  <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
  <script>
    (adsbygoogle = window.adsbygoogle || []).push({
      google_ad_client: "ca-pub-6388904949115093",
      enable_page_level_ads: true
    });
  </script>

</head>


<body>

  <!-- Google Tag Manager (noscript) -->
  <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TDQN47K" height="0" width="0"
      style="display:none;visibility:hidden"></iframe></noscript>
  <!-- End Google Tag Manager (noscript) -->
  <!--
<script type="text/javascript" src="//downloads.mailchimp.com/js/signup-forms/popup/unique-methods/embed.js" data-dojo-config="usePlainJson: true, isDebug: false"></script><script type="text/javascript">window.dojoRequire(["mojo/signup-forms/Loader"], function(L) { L.start({"baseUrl":"mc.us19.list-manage.com","uuid":"03ca4072c8df4a1afb3cd38d4","lid":"9508982951","uniqueMethods":true}) })</script>
-->
  <div id="wrapper">
    <header id="header">
      <!-- Navbar
    ================================================== -->
      <div class="navbar navbar-fixed-top">
        <div class="navbar-inner">
          <div class="container" style="position: relative;">

            <!-- logo -->
            <div class="logo">
              <a href="/">Buzz Chronicles</a>
            </div>
            <!-- end logo -->

            <div id="nav-signup">
              <a href="https://twitter.com/intent/user?screen_name=buzz_chronicles">
                <span class="read-more"
                  style="background: #2980b9; font-size: 13px; line-height: 20px; border-radius: 2px; padding-left: 10px; padding-right: 10px; padding-bottom: 6px; padding-top: 6px;">Follow</span>
              </a>
              <i id="mobile-menu-button" class='icon-reorder'></i>
            </div>

            <!-- top menu -->
            <div class="navigation">
              <nav>
                <ul class="nav topnav">
                  <li>
                    <a href="/">Home</a>
                  </li>
                  <li class="dropdown">
                    <a href="/b/all">Threads <i class="icon-angle-down"></i></a>
                    <ul class="dropdown-menu" style="display: none;">
                      <li><a href="/d">Daily Charts</a></li>
                      <li id="menu-popular"><a href="#">Most Popular</a></li>
                      <li id="menu-recent"><a href="#">Most Recent</a></li>
                    </ul>
                  </li>
                  <li>
                    <a href="/a/">Authors</a>
                  </li>
                  <li class="dropdown">
                    <a href="/b">Categories <i class="icon-angle-down"></i></a>
                    <ul class="dropdown-menu" style="display: none;">
                      <li><a href="/b/life">Life</a></li>
                      <li><a href="/b/tech">Tech</a></li>
                      <li><a href="/b/culture">Culture</a></li>
                      <li><a href="/b/politics">Politics</a></li>
                      <li><a href="/b/society">Society</a></li>
                      <li><a href="/b/fun">Fun</a></li>
                      <li><a href="/b">See All Categories <i class="icon-angle-right"></i></a></li>
                    </ul>
                  </li>
                  <li>
                    <a href="/p/about">About</a>
                  </li>
                </ul>
              </nav>
            </div>
            <!-- end menu -->

          </div>
        </div>
      </div>
    </header>

    <section id="maincontent">

      


    <!-- Modal -->
    <div class="modal fade" id="share-modal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel">
      <div class="modal-dialog modal-dialog-centered" role="document">
        <div class="modal-content">

          <div class="modal-body">
            <button type="button" class="close" data-dismiss="modal" aria-label="Close"><span
                aria-hidden="true">&times;</span></button>
            <h4 class="modal-title" id="myModalLabel">Share it somewhere</h4>
            <center>
              <ul class="social" style="margin-top: 30px; margin-bottom: 30px;">
                <li><a
                    href="https://twitter.com/intent/tweet?text=Tweet%20by%20%40depletionmode%20https%3A%2F%2Fbuzzchronicles.com%2Fcollection%2F7795"
                    target="_blank" data-placement="bottom" title="" data-original-title="Twitter"><i
                      class="icon-twitter icon-rounded icon-32"></i></a></li>
                <li><a
                    href="https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fbuzzchronicles.com%2Fcollection%2F7795"
                    target="_blank" data-placement="bottom" title="" data-original-title="Facebook"><i
                      class=" icon-facebook icon-rounded icon-32"></i></a></li>
                <li><a
                    href="https://www.reddit.com/submit?url=https%3A%2F%2Fbuzzchronicles.com%2Fcollection%2F7795"
                    target="_blank" data-placement="bottom" title="" data-original-title="Reddit"><i
                      class=" icon-reddit icon-rounded icon-32"></i></a></li>
                <li><a
                    href="https://www.linkedin.com/shareArticle?mini=true&url=https://buzzchronicles.com/collection/7795"
                    target="_blank" data-placement="bottom" title="" data-original-title="Linkedin"><i
                      class=" icon-linkedin icon-rounded icon-32"></i></a></li>
              </ul>
            </center>

          </div>

        </div>
      </div>
    </div>

    <div class="container">

      <div class="row" style="margin-bottom: 0px;">
        
        <div> 
          <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
          <!-- header -->
          <ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-6388904949115093"
            data-ad-slot="5729326871" data-ad-format="auto" data-full-width-responsive="true"></ins>
          <script>
            (adsbygoogle = window.adsbygoogle || []).push({});
          </script>
        </div>
        
        <div style="margin-bottom: 20px;">          
        </div>

        <div class="span1"></div>
        <div class="span10">
          <div class="row">           

            <div class="story-header">
              <div class="to-left" style="width: 50%;">
                <a href="/">BUZZ CHRONICLES</a>
                <i class="icon-angle-right" style="margin-left: 5px; margin-right: 5px;"></i>
                <a href="/b/internet">INTERNET</a>
              </div>
              <div class="to-right" style="float: right;"><a href="/Mollyycolllinss"><span class="btn"
                    style="margin-top: -5px;">Saved by @Mollyycolllinss</span></a></div>
            </div>

            <div id="author-info" class="row">
              <div class="to-left to-left-author" style="padding-bottom: 15px;">
                <div class="profile-picture-original">
                  <a href="https://twitter.com/depletionmode" target="_blank">
                    
                    

<img id="profile-pic-img" src="https://pbs.twimg.com/profile_images/1255263745359728640/4vCe_3z9_normal.jpg" onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"' style="border-radius: 50%; width: 48px; height: 48px;" alt="David Kaplan">


                    

                  </a>
                </div>
                <span class="original-display-name"><a href="https://twitter.com/depletionmode" target="_blank">
                  David Kaplan
                </a></span> <br>
                <span class="original-screen-name"><a href="https://twitter.com/depletionmode" target="_blank">
                  @depletionmode
                </a></span>
                <span style="font-size: 11px;">
                  <i class="icon-calendar" style="margin-left: 12px; margin-right: 9px;"></i><span>
                    1 year, 7 months ago
                  </span>
                  <i class="icon-group" style="margin-left: 12px; margin-right: 9px;"></i><span>504
                    views</span>

                </span>
              </div>
              <div class="to-right">
                <div style="position: relative; margin-top: 5px; text-align: right;">
                  <span class="btn">
                    <a href="/f/internet/7795">
                      <i class="icon-save"></i><span>Save to PDF</span>
                    </a>
                  </span>
                  <span class="btn">
                    <a href="#" data-toggle="modal" data-target="#share-modal">
                      <i class="icon-retweet"></i><span>Share</span>
                    </a>
                  </span>
                  <!--<a href="#"><i class="icon-envelope-alt"></i><span>Subscribe</span></a>-->
                  <span class="btn">
                    <a href="https://twitter.com/depletionmode/status/1348654607401152514" target="_blank">
                      <i class="icon-twitter icon-16"></i> See On Twitter
                    </a>
                  </span>
                  <!--<span class="btn">
	      <a href="#"><i class="icon-heart-empty"></i></a>
	    </span>-->
                </div>



              </div>

            </div>
            <h1><b>Linux code injection paint-by-numbers.<br/><br/>Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).<br/><br/>Firstly, how are processes created and what does related auditing look like?</b></h1>
            

            

          </div>

          

          <div class="row">

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348654954530148353" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              The most common pattern is fork() → execve(). Where the fork() syscall create a duplicate of the running process context and execve() overlays a copy of the target program onto that context.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348654955742289920" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              After calling fork(), we’ll have two processes, the original one and a new - duplicated - one (with a new pid). <br/>  <br/> Control will return from fork() to both process instances. In the child process, the return value will simply by 0, in the parent it will hold the pid of the child.
              

              

            </div>

             

            
            
            <div class="ad-container"> 
              <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
              <ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article"
                data-ad-format="fluid" data-ad-client="ca-pub-6388904949115093" data-ad-slot="8375986841"></ins>
              <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
              </script>
            </div>
            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348654956912455680" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Thus we can determine whether we are running in the child context and call execv() accordingly, while allowing the parent to continue.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdibJGW8Acjvm7.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655701137227780" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Now, let’s take a look at where the auditing hooks lie. From calling execve(), we’ll eventually land up in exec_binrpm().
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655702479417344" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Without delving too deeply, this function resolves the interpreter handler for the target we’re trying to execute. (Here we’re executing an ELF binary, so we’ll get the relevant ELF handler). But that is a topic for another day.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655705935458309" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Prior to exec_binrpm() returning, audit hooks will be called.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/Erdi2V3W8AAGnJC.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655707369971713" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              In our scenario, we *want* these hooks to be called so the original target executable is identified, but we don’t want the target to actually execute.
              

              

            </div>

             

            

        

            
            
            <div class="ad-container"> 
              <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
              <ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article"
                data-ad-format="fluid" data-ad-client="ca-pub-6388904949115093" data-ad-slot="6074801722"></ins>
              <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
              </script>
            </div>
            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655708598902790" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              On Windows, all processes are created suspended; CreateProcess could be called with the CREATE_SUSPENDED flag in order to instruct Kernel32.dll not to get the kernel to resume the target after process setup.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655709949407234" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              On Linux, process execution will continue immediately after execv() so we must do something different. We can use ptrace() to control execution of the child target.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348655713569153028" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              This is set up by first instructing the kernel from the child context that it wants to be traced (PTRACE_TRACEME) and then instructing the parent process to wait on the first trap. <br/>  <br/> By default, this will happen on exit of the execve() syscall.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdjM2XXIAchDBu.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656255645188099" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Now that we have a form of suspended process creation, we need to decide what to do with it. <br/>  <br/> The options here are numerous. In this example, we want to chose a strategy that doesn’t require us doing any image/reloc fix-up foo. <br/>  <br/> We can use dlopen() to do all the heavy lifting.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656257423519748" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              The first issue is that we have suspended execution in a state prior to libc being mapped in and made available to the target process. As (almost?) all dynamically linked processes will require libc, we can let this happen naturally by letting the target run until this is done.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656258954440707" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              It is important to ensure that (1) the execution progresses to a point where libc is mapped and (2) the process is in a state where we can safely hijack execution flow, but (3) is prior to actual target execution (+ generic enough to support various targets).
              

              

            </div>

             

            

        

            

            

            
            
            <div class="ad-container"> 
              <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
              <ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article"
                data-ad-format="fluid" data-ad-client="ca-pub-6388904949115093" data-ad-slot="6565756318"></ins>
              <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
              </script>
            </div>
            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656262720999424" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              I initially tried trapping target execution after libc is mapped (executing until relevant close()).
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdjlMwXYAYt51w.jpg">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656264503586817" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Naturally this failed as the process was not yet sufficiently set up to support stable execution (for e.g. stack sentinel storage via mov    rax,QWORD PTR fs:0x28 in the function prologue would fail; fs is not yet sane).
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656427783626764" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              To achieve a state where (1), (2), and (3) are all honoured, we can trap a little further down. I chose to target brk().
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/Erdj106XcAAuXba.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656588639375360" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              To recap: <br/>  <br/> We’ve created a child process and halted execution prior to anything too process-specific having been run but after basic setup has taken place.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348656589927026688" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Now we need to get inject our code.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657654844051457" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              As mentioned earlier, the plan is to use bog-standard dlopen() to get the code staged in the target. <br/> But how to locate dlopen()? <br/>  <br/> A cursory glance shows that dlopen() is exported by libdl. But alas this library is not loaded in our process address space.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdkRwkXUAAlSR1.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657658895753220" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Ultimately, however, __libc_dlopen_mode() is the underlying libc function that will do the work and that is available to us.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdkUOqW8AAjv7F.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            
            
            <div class="ad-container"> 
              <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
              <ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article"
                data-ad-format="fluid" data-ad-client="ca-pub-6388904949115093" data-ad-slot="5642846448"></ins>
              <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
              </script>
            </div>
            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657660829298688" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              First, we’re going to need to get the offset of the __libc_dlopen_mode() function within libc.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657664880992256" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              The easiest way I could think of, of doing this programmatically was simply to use the dynamic linker within the parent process context + calculating the offset from the loaded library address. <br/>  <br/> dlopen(libc) → dlsym(__libc_dlopen_mode)
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdkdYCWMAM4T-7.jpg">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657666609061888" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              The library address can be obtained from the link_map structure returned by dlopen().
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657668194447361" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              A caveat to keep in mind here is that taking the fcn_addr - lm->l_addr yields an offset which includes the difference between the address in the ELF binary and where address where it was loaded in memory. <br/>  <br/> We will account for this offset skew shortly.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657669830283264" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Next, we’ll obtain the address of the libc instance that is mapped in our target process.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657671151513600" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Procfs exposes mapping info in /proc/<pid>/maps. We can look up the mapped address of the executable section of libc, accounting for the offset of the in-memory address of the mapped ELF and calculate a final value for __libc_dlopen_mode() in the target.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657675178012676" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              My implementation of this bit is, regrettably, quick & dirty.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdksRBW8AIXwjS.jpg">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657677145165824" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Finally, we need to set the necessary arguments for __libc_dlopen_mode() and call the function within the target process context.
              

              

            </div>

             

            

        

            

            

            


            

            
            
            <div class="ad-container"> 
              <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
              <ins class="adsbygoogle" style="display:block; text-align:center;" data-ad-layout="in-article"
                data-ad-format="fluid" data-ad-client="ca-pub-6388904949115093" data-ad-slot="6800618084"></ins>
              <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
              </script>
            </div>
            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657678411837446" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Remembering that we don’t care to continue with the original target flow at any point, we can hijack execution by pointing rip to the address of __libcdl_open_mode() that we just calculated.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657682203488258" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              The function signature for __libcdl_open_mode() matches that of dlopen() - with the addition of an explicit *dl_caller which I just set to NULL. <br/>  <br/> x86_64 calling convention dictates that we’ll be using registers rdi (library path), rsi (mode), rdx (dl caller).
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/Erdk4CpXIAAU2Az.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348657686452305927" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              rdi holds a pointer to the library path. We need somewhere writeable to put it. <br/>  <br/> The easy choice here is just to dump it somewhere on the stack (we’re not interested in a sane return  from __libc_dlopen_mode() after all).
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/Erdk6_kWMAM6pSh.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658153257316352" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Everything is now set up. Releasing target execution will result in our code being loaded into the target address space via __libc_dlopen_mode().
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdlJK0WMAI3m9i.jpg">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658155258052613" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              At some point, something will break in the target application (remember, we have hijacked rip and corrupted the stack). <br/>  <br/> This is a great outcome as it’ll trap back into the parent process and allow us to redirect control to our injected code.
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658156860301313" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              (I did initially mess around with getting better control over the return from libc but honestly it didn’t seem worth the bother.)
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658160081502211" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Calling our injected code is as simple as pointing rip at it and resuming execution. (We discover its loaded address in the very same way that we discovered that of __libc_dlopen_mode() previously.)
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdlQo3XcAIVQXZ.jpg">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658163650879489" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Finally we can detach the parent process. <br/>  <br/> And we’re done.
              <div class="post-media-outer">
                <div class="post-media-inner">
                  <img src="https://pbs.twimg.com/media/ErdlU2KXMAoDMKq.png">
                </div>
              </div>
              

              

            </div>

             

            

        

            

            

            


            

            

            

            <div class="post-content">
              <a href="https://twitter.com/depletionmode/status/1348658165416648706" target="_blank">
                <div class="post-permalink">
                  <i class="icon-twitter icon-32"></i>
                </div>
              </a>

              
              Now in terms of forensics: <br/>  <br/> Auditing ptrace() is the obvious go-to for real-time process injection determination <br/>  <br/> Beyond that; process memory space anomalies (in this example, the injected code will appear as a mapped image) + the usual gamut of behavioural analysis opportunities
              

              

            </div>

            

          </div>

          

        </div>
        <div class="span1"></div>
      </div>

      



      
      <div class="break-after-ad"></div>
      
      <div> 
        <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
        <!-- more-from-category-horizontal -->
        <ins class="adsbygoogle"
            style="display:block"
            data-ad-client="ca-pub-6388904949115093"
            data-ad-slot="2742154153"
            data-ad-format="auto"
            data-full-width-responsive="true"></ins>
        <script>
            (adsbygoogle = window.adsbygoogle || []).push({});
        </script>
      </div>
      <div class="break-after-ad"></div>

      <h4 class="rheading">More from Internet<span></span></h4>
      <div class="row">

        


        

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/fchollet">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1234692331263016960/7uR-nYW0_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Fran\xe7ois Chollet">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/fchollet">
                    François Chollet
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/fchollet">
                    @fchollet
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/internet/6495/">
                    <div class="collection-item">
                     Here's an overview of key adoption metrics for deep learning frameworks over 2020: downloads, developer surveys, job posts, scientific publications, Colab usage, Kaggle notebooks usage, GitHub data.<br/><br/>TensorFlow/Keras = #1 deep learning solution.


            
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/Eq-5q5XU0AATotg.jpg">
              </div>
            </div>
            

            
            
            
            

            <br/><br/>
              Note that we benchmark adoption vs Facebook's PyTorch because it is the only TF alternative that registers on the scale. Another option would have been sklearn, which has massive adoption, but it isn't really a TF alternative. In the future, I hope we can add JAX.
              
              

            


            

            <br/><br/>
              TensorFlow has seen 115M downloads in 2020, which nearly doubles its lifetime downloads. Note that this does *not* include downloads for all TF-adjacent packages, like tf-nightly, the old tensorflow-gpu, etc.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/Eq-6EYzUwAEnXfI.jpg">
              </div>
            </div>
            

            


            

            <br/><br/>
              Also note that most of these downloads aren't from humans, but are automated downloads from CI systems (but none are from Google's systems, as Google doesn't use PyPI).<br/><br/>In a way, this metric reflects usage in production.
              
              

            


            

            <br/><br/>
              There were two worldwide developer surveys in 2020 that measured adoption of various frameworks: the one from StackOverflow, targeting all developers, and the one from Kaggle.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/Eq-6XVqVoAMJn-m.jpg">
              </div>
            </div>
            

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/internet/" class="grey-link">INTERNET</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>




        

        

        


        

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/e_hayes12">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1530479655135985665/0C2C_0O1_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Elaine Hayes MCCT #MIEExpert \u2618">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/e_hayes12">
                    Elaine Hayes MCCT #MIE...
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/e_hayes12">
                    @e_hayes12
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/internet/5687/">
                    <div class="collection-item">
                     A thread on teaching live lessons using @MicrosoftTeams Meet Now function where students follow their normal timetable except online - will go into more detail on every point in a blog post later. Have used Teams for live teaching have supported over 100 live lessons since March


            

            
            
            
            

            <br/><br/>
              1. If you are using the desktop app, check you have the latest version of Teams so that you should have Breakout rooms enabled. Check by clicking your profile picture, then About - I have version 1.3.00.28779. If you have 1.2..., click on check for updates to get the latest
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EquC_52W4AE1s0q.png">
              </div>
            </div>
            

            


            

            <br/><br/>
              2. Set your entry routine. I get my students to enter with their microphone muted - you can also not allow attendees to unmute by opening the participants list, clicking the ellipsis and selecting that option.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EquGIz7XIAAbO42.png">
              </div>
            </div>
            

            


            

            <br/><br/>
              3. Make sure students arrive as attendees - some organisations have this set up to automatically happen that only meeting organizer is the presenter and others are attendees.  Can change this in the manage permissions menu to only me if not already set (opens in a web browser).
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EquF60cXYAARg3q.png">
              </div>
            </div>
            

            


            

            <br/><br/>
              4. Classroom routine and expectations - first lesson I share my screen and show the students the raise hand function for when they want to ask questions, how to access the chat function and how to react to questions as opposed to typing answers
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EquHVjCW8AArCf0.png">
              </div>
            </div>
            

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/internet/" class="grey-link">INTERNET</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>




        

        <div class="span4" style="display: inline-block;">

          <div class="box box-collection">

            <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
                <div class="profile-picture-original">
                  <a href="/collection/" target="_blank">

                  </a>
                </div>
                <span class="original-display-name"><a href="/collection/">Advertisement</a></span> <br>
              </div>
              <div class="span2">
                <div style="position: relative; margin-top: 5px;">

                </div>
              </div>
            </div>
            <div class="row no-color" style="margin-bottom: 7px;">

              <div class="collection-item advertisement">

                <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
                <!-- more-from-category -->
                <ins class="adsbygoogle"
                    style="display:inline-block;width:250px;height:250px"
                    data-ad-client="ca-pub-6388904949115093"
                    data-ad-slot="7568579622"></ins>
                <script>
                    (adsbygoogle = window.adsbygoogle || []).push({});
                </script>

              </div>
            </div>


          </div>
        </div>

        

        

        


        

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/DisclosureBP">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1353525011026386944/kQJA0wBN_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Disclosure Backpack">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/DisclosureBP">
                    Disclosure Backpack
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/DisclosureBP">
                    @DisclosureBP
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/internet/6900/">
                    <div class="collection-item">
                     Affidavit by former head of IT for large Italian defense contractor admitting he uploaded instructions through military satellite to Frankfurt to flip votes from Trump to Biden on election night under direction of US persons. Willing to testify.#ItalyDidIt


            

            
            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/internet/" class="grey-link">INTERNET</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>




        

        

        


        

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/ThyConsigliori">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1541089347197440001/ekAfeURG_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Pasquale &quot;Pat&quot; Scopelliti">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/ThyConsigliori">
                    Pasquale &quot;Pat&quot; Scopell...
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/ThyConsigliori">
                    @ThyConsigliori
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/internet/5247/">
                    <div class="collection-item">
                     Prepping for today's thread, the story of the CURRENT CYBERWAR is clearly overwhelming. J.E. Dyer @OptimisticCon links us to this story. Just one quote to


            

            
            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/internet/" class="grey-link">INTERNET</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>




        

        

        


        

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/Foone">
                    

<img id="profile-pic-img" src="https://pbs.twimg.com/profile_images/880340410333143040/-s_buYC0_normal.jpg" onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"' style="border-radius: 50%; width: 48px; height: 48px;" alt="foone">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/Foone">
                    foone
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/Foone">
                    @Foone
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/internet/5482/">
                    <div class="collection-item">
                     I was hacking a game and accidentally invented a word for when you think someone is trans and you're proud of them for coming out but then you find out they aren't


            
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EqodsB2UwAAnLUZ.png">
              </div>
            </div>
            

            
            
            
            

            <br/><br/>
              someone is excited to watch bill nye in science class
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/EqoefKoVgAAJ0go.png">
              </div>
            </div>
            

            


            

            <br/><br/>
              This happens because one of the ways I figure out which memory location needs to be modified is by memory-searching for all occurrences and changing the first letter of them
              
              

            


            

            <br/><br/>
              so like if I know the next line of dialog is "Die"<br/>I change it to "Aie" "Bie" "Cie" "Eie" "Fie"
              
              

            


            

            <br/><br/>
              then I see which one shows up in the game
              
              

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/internet/" class="grey-link">INTERNET</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>




        

        

        

      </div>

      

      <div class="row">
        <div class="span12">

          <div class="break-after-ad"></div>
          
          <div> 
            <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
            <!-- you-may-also-like-horizontal -->
            <ins class="adsbygoogle"
                style="display:block"
                data-ad-client="ca-pub-6388904949115093"
                data-ad-slot="1348169671"
                data-ad-format="auto"
                data-full-width-responsive="true"></ins>
            <script>
                (adsbygoogle = window.adsbygoogle || []).push({});
            </script>
          </div>
          <div class="break-after-ad"></div>

          <h4 class="rheading">You May Also Like<span></span></h4>
          


          

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/LiteraryMouse">
                    

<img id="profile-pic-img" src="https://pbs.twimg.com/profile_images/1034201216123846657/hycqh30b_normal.jpg" onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"' style="border-radius: 50%; width: 48px; height: 48px;" alt="Melissa (she/her)">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/LiteraryMouse">
                    Melissa (she/her)
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/LiteraryMouse">
                    @LiteraryMouse
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/politics/7215/">
                    <div class="collection-item">
                     In regards to the #CapitolCoup, I’m in a unique position. I monitored forums ahead of time and then was present for the coup itself.<br/><br/>These are my observations based on what I saw and the evidence that’s been collected so far. I reserve the right to adjust my analysis as needed.


            

            
            
            
            

            <br/><br/>
              Let’s talk about the organization of the coup first. Seeing some people insist that the coup must have been highly planned and coordinated.<br/><br/>Yes and no. This was a #StochasticCoup. We’ll see little evidence of direct communication between Trump and the insurrectionists.
              
              

            


            

            <br/><br/>
              Within the insurrectionists, there was not one group that executed the storming of the Capitol.<br/><br/>Rather, there were a number of smaller groups working independently towards the same goal. I expect you’ll see little evidence that these various groups communicated with each other.
              
              

            


            

            <br/><br/>
              What you will see is detailed planning and coordination within these small groups. <br/><br/>Then there were the joyriders, those Trump supporters who weren’t directly involved in any plotting but who were more than happy to go along for the ride once the coup was in motion.
              
              

            


            

            <br/><br/>
              After four years, the insurrectionists were carefully attuned to Trump’s messaging. <br/><br/>Every tweet and statement of his was treated as marching orders and carefully dissected for meaning. <br/><br/>It’s why shutting down Trump’s Twitter account was so important.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ErSby9MWMAAhwKX.jpg">
              </div>
            </div>
            

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/politics/" class="grey-link">POLITICS</a>
               
               , <a href="/b/insurrectionists/" class="grey-link">INSURRECTIONISTS</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>





          

          

          


          

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/mikedicenzo">
                    

<img id="profile-pic-img" src="https://pbs.twimg.com/profile_images/1240678317/Deetch_normal.png" onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"' style="border-radius: 50%; width: 48px; height: 48px;" alt="Mike DiCenzo">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/mikedicenzo">
                    Mike DiCenzo
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/mikedicenzo">
                    @mikedicenzo
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/government/9486/">
                    <div class="collection-item">
                     "How the Avengers would respond to the Capitol riot" (a thread)<br/><br/>CAPTAIN AMERICA - tells Falcon, "I fought Nazis once before. They're extremely dangerous." They then see the guy scaling the Capitol wall fall into the shrubs. Falcon: "You sure these are the same Nazis?"


            

            
            
            
            

            <br/><br/>
              IRON MAN - lands by the guy carrying the podium. Says, "Mind if I borrow this?" then tosses it to Hulk, who swings it like a bat at the mob. Guy: "Hey, that's MY podium!" Iron Man: "Actually it's the Speaker's. And technically, it's a lectern." Then punches him through a wall.
              
              

            


            

            <br/><br/>
              BLACK WIDOW - enters hotel room where Jack Dorsey is tied up. Rips duct tape off his mouth. Jack: "I'll do anything you want!" BW: "Disable POTUS's Twitter. NOW!" Jack fumbles with his phone. "Done. Anything else?" BW: "Yeah. Trim your beard for God's sake." *tosses him clippers*
              
              

            


            

            <br/><br/>
              HULK - grabs a selfie stick from one of the guys and beats him over the head with it. Deeming it too small, he grabs another guy's Confederate flag and takes out a whole swath of rioters. He then tosses the flag to Cap, who uses it as a javelin to impale a fleeing Ted Cruz.
              
              

            


            

            <br/><br/>
              HAWKEYE - hears Iron Man in his earpiece say, "Looks like Orange Julius is tweeting from another account." Hawkeye: "On it." He locks in on Trump through the White House window and fires an arrow, knocking the phone out of Trump's hands. Hawkeye: "Damn that felt good."
              
              

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/government/" class="grey-link">GOVERNMENT</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>





          

          <div class="span4" style="display: inline-block;">

            <div class="box box-collection">

              <div class="row" style="margin-bottom: 0px;">
                <div class="span4" style="padding-bottom: 15px;">
                  <div class="profile-picture-original">
                    <a href="/collection/" target="_blank">

                    </a>
                  </div>
                  <span class="original-display-name"><a href="/collection/">Advertisement</a></span> <br>
                </div>
                <div class="span2">
                  <div style="position: relative; margin-top: 5px;">

                  </div>
                </div>
              </div>
              <div class="row no-color" style="margin-bottom: 7px;">

                <div class="collection-item advertisement">

                  <script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
                  <!-- you-may-also-like-1 -->
                  <ins class="adsbygoogle"
                      style="display:inline-block;width:250px;height:250px"
                      data-ad-client="ca-pub-6388904949115093"
                      data-ad-slot="5944243432"></ins>
                  <script>
                      (adsbygoogle = window.adsbygoogle || []).push({});
                  </script>

                </div>
              </div>


            </div>
          </div>

          

          

          


          

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/SamKhan999">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1558393696915038208/lvCS3Lf5_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Sam">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/SamKhan999">
                    Sam
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/SamKhan999">
                    @SamKhan999
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/india/5829/">
                    <div class="collection-item">
                     This day was inevitable. Indian Muslims always lived in La La Land. They bad mouthed real well wishers & slept with the enemy who never considered them as part of them. In Gulf, Indian Muslims were busy with Javed Akhtar & Sonu Nigam. Never interacted with South Asian diaspora


            

            
            
            
            

            <br/><br/>
              Now when Indian Muslims are thrown to wolves it’s Pakistani & Bangladeshi Muslims with whom they kept distance are the only ones feeling their pain. None of the people who they invited for Eid Milan. Qawali & Mushaira are there for them. Such people invoke wrath upon themselves
              
              

            


            

            <br/><br/>
              Indian Muslims never spoke for Kashmiri Muslims. Distancing from separatist was understandable but we never even bothered to highlight their human rights violation & rapes carried out by forces. We could have sent them humanitarian help we didn’t. Our silence made us complicit.
              
              

            


            

            <br/><br/>
              When Sania Mirza married Shoaib Malik it was something legal. A Muslim married another Muslim. Entire Hindutva media went after her. They launched a witch-hunt for months. No Indian Muslim stood by her. All were silent. Now days come when Muslims are arrested for marrying a Hindu
              
              

            


            

            <br/><br/>
              Indian Muslims particularly the elite downplayed communalism in India by saying it will pass or Hindu majority is good. Fringe are bad. They misguiding others. Muslims were always others. Indians were happy to see Muslims sing & dance & eat their food but never considered as own
              
              

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/india/" class="grey-link">INDIA</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>





          

          

          


          

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/RijhwaniSheetal">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1559510107704004608/NC_z28UH_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Sheetal Rijhwani">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/RijhwaniSheetal">
                    Sheetal Rijhwani
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/RijhwaniSheetal">
                    @RijhwaniSheetal
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/screeners/17234/">
                    <div class="collection-item">
                     How you can filter stocks for Intraday trades - 🧵<br/><br/>As a kid, we would do homework before school the next day - you have to do homework here too. A specific sector performs on a particular day and studying things a day before will help you spot that particular sector. (1/11)


            

            
            
            
            

            <br/><br/>
              To prepare for the next trading day, you got to check the Index charts of all sectors. You got to keep an eye on a specific Index if you see a few factors:<br/><br/>- If any Index closed exactly at the resistance, you can get a trade on either side on the next day. (2/11)
              
              

            


            

            <br/><br/>
              - If it gave a rejection candle at resistance.<br/><br/>- If any Index closed exactly at support, you can get a trade on either side the following day. <br/><br/>- If there was a bullish signal at the support.<br/><br/>- If any Index gave a breakout or breakdown and then gave a good closing. (3/11)
              
              

            


            

            <br/><br/>
              - If any Index has taken support at 50 or 200 EMA.<br/><br/>Once you spot the Index, look at all the stocks in that particular Index. Pick at least 3-4 stocks from that Index and add them to your watchlist for the next day. It's ideal to check both higher and lower timeframes. (4/11)
              
              

            


            

            <br/><br/>
              What you should do next day? (When I am unable to check Indices and stocks a day before, I sometimes directly start with this process.)<br/><br/>- Start with checking the top gainers/losers list. I observe market from 9:15 to 9:45am to check the sectors performing well on that day.(5/11)
              
              

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/screeners/" class="grey-link">SCREENERS</a>
               
               , <a href="/b/all/" class="grey-link">ALL</a>
               
               , <a href="/b/intraday+strategies/" class="grey-link">INTRADAY STRATEGIES</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>





          

          

          


          

		<div class="span4" style="margin-left: 0px; display: inline-block;">
                

                  <div class="box box-collection left-box">
                   <div class="row" style="margin-bottom: 0px;">
              <div class="span4" style="padding-bottom: 15px;">
              <div class="profile-picture-original">
                  <a href="/a/VIBHU_Tweet">
                    

<img 
  id="profile-pic-img"
  src="https://pbs.twimg.com/profile_images/1522459379156455424/nwGru-Pg_normal.jpg" 
  onerror='this.src="https://abs.twimg.com/sticky/default_profile_images/default_profile_normal.png"'
  style="border-radius: 50%; width: 48px; height: 48px;" alt="Vibhu Vashisth">


                  </a>
              </div>
                <span class="original-display-name">
                  <a href="/a/VIBHU_Tweet">
                    Vibhu Vashisth
                  </a>
                </span><br>
                <span class="original-screen-name">
                  <a href="/a/VIBHU_Tweet">
                    @VIBHU_Tweet
                  </a>
                </span>
              </div>
              <div class="span2">    
                <div style="position: relative; margin-top: 5px;">
                  
                </div>
              </div>  
    </div>
                  <div class="row no-color" style="margin-bottom: 15px;">

                  <a href="/b/all/13116/">
                    <div class="collection-item">
                     RANI NAIKI DEVI AND THE BATTLE OF KASAHRADA <br/><br/>Mohammad Ghori, the young Ghurid Prince conquered Ghaznavids in Afghanistan in the year 1173 CE. He conducted some successful raids into the Indian territory, which even Mahmud Ghazni & the Persians couldn't do.


            
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ExALsShVcAUc3xL.jpg">
              </div>
            </div>
            

            
            
            
            

            <br/><br/>
              First&foremost,Ghori invaded states of Multan &Uch in India.After this he turned to southern states of Gujarat &Rajputana.Everybody knows this about Ghori,but what most pple r unaware of is the defeat he suffered at hands of Chalukyan Queen Naiki Devi in 1178 Battle of Kasahrada.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ExALs-JVIAEvY_J.jpg">
              </div>
            </div>
            

            


            

            <br/><br/>
              When he marched southwards, his first target was the prosperous fortified town of Anhilwara Patan.<br/>It was the capital of Chalukyas(also known as Solankis of Gujarat) which was established by Vanraj of Chapotkata Dynasty in 8th century.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ExALtl-VkAAmbxD.jpg">
              </div>
            </div>
            

            


            

            <br/><br/>
              American historian Tertius Chandler states that it was the 10th largest city in the world at that time. The history of Chalukyas has been written by many historians, but the valour of the Great Queen Naiki Devi remains unsung.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ExALue_UUAEQopt.jpg">
              </div>
            </div>
            

            


            

            <br/><br/>
              Born to the Kadamba King Paramardin of Goa,Naiki Devi was well trained in sword fighting, horse riding, strategy & every other subject of Statesmanship. She was married to King Ajaypala of Gujarat who sat on throne in 1171CE. Unfortunately,the King died within 4 yrs of his rule.
              
              
            <div class="post-media-outer-list">
              <div class="post-media-inner-list">
                <img src="https://pbs.twimg.com/media/ExALvT9UUAYM-aN.jpg">
              </div>
            </div>
            

            


            
            


                    </div>
                </a>
                </div>
             <div class="category-footer"><i class="icon-tags"></i> 
               
               <a href="/b/all/" class="grey-link">ALL</a>
               
             </div> 
             <div class="like-footer"><!--<i class="icon-heart-empty"></i>--></div> 

                 </div>

                    
              </div>





          

          

          

          

      </div>

    </div>

    </div>

    
    </section>
    <!-- Footer
 ================================================== -->
    <footer class="footer" id="footer">
      <div class="container">
        <div class="row">
          <div class="span6">
            <div class="widget">
              <h5>How does it work?</h5>
              <ul class="regular" style="font-size: 15px; color: #b8b8b8;">
                <li>&#128172; Reply to a thread with "@buzz_chronicles save" or "@buzz_chronicles save as category"</br>
                  &#x1F916; Our bot will send you a link to your own folder on Buzz Chronicles. The thread will be saved
                  in a form of an easy-to-read article<br />
                  &#x1F4C1; All your saved threads will be available at buzzchronicles.com/<i>your_twitter_handle</i>
                </li>
              </ul>
              <div class="clear"></div>
            </div>
          </div>

          <div class="span2">

          </div>

          <div class="span4">
            <div class="widget">
              <h5>Buzz Chronicles</h5>
              <div class="span2">
                <ul class="regular">
                  <li><a href="/">Explore</a></li>
                  <li><a href="/b/all">Threads</a></li>
                  <li><a href="/d">Daily Charts</a></li>
                  <li><a href="/b/all">Authors</a></li>
                  <li><a href="/b">Categories</a></li>
                </ul>
              </div>
              <div class="span2">
                <ul class="regular">
                  <li><a href="/p/about">About</a></li>
                  <li><a href="/p/tos">Terms of Service</a></li>
                </ul>
              </div>

            </div>
          </div>



        </div>
      </div>
      <div class="verybottom">
        <div class="container">
          <div class="row" style="text-align: center;">
            <div style="display: inline-block;">
              <p>
                Copyright &copy; 2021 Buzz Chronicles - All right reserved
              </p>
            </div>

          </div>
        </div>
      </div>
    </footer>

  </div>
  <!-- end wrapper -->
  <a href="#" class="scrollup"><i class="icon-chevron-up icon-square icon-48 active"
      style="background: #2980b9;"></i></a>

  <script src="/static/stories/assets/js/jquery.js"></script>
  <script src="/static/stories/assets/js/bootstrap.js"></script>
  <script src="/static/stories/assets/js/jquery.elastislide.js"></script>
  <script src="/static/stories/assets/js/jquery.prettyPhoto.js"></script>
  <script src="/static/stories/assets/js/jquery.flexslider.js"></script>
  <script src="/static/stories/assets/js/jquery-hover-effect.js"></script>
  <script src="/static/stories/assets/js/animate.js"></script>

  
  <script type="text/javascript">
    $(function() {
        $('.lazy-tag').each(function(i, elem) {
            var tag = $(elem);
            var tag_id = tag.attr('id');
            var url = '/lazy_tags/tag/' + tag_id;

            $.ajax({
                type: 'GET',
                url: url,
                success: function(data) {
                    $('#' + tag_id).replaceWith(data);
                },
                error: function(data) {
                    $('#' + tag_id).replaceWith('An error occurred.');
                }
            });

        });
    });
</script>
  

  <!-- Template Custom JavaScript File -->
  <script src="/static/stories/assets/js/custom.js?v=1.5"></script>

<script>(function(){var js = "window['__CF$cv$params']={r:'73c3ce7c5f17070a',m:'kXNKCx7JaKOrSnhhfSMdT4D0DLmZKEIJ2MBJ.AbZ3wE-1660753956-0-Ac88HwQf4CxwA5hZqqmXk6DhtM5HnSuWYeopNWSiAbOYNYDbQe7vGhfshNp7FbWdRT7rqcvcRJch9SBwRR2R8fZyaBhle1gtqxNDzPiXihLFEL1LGjVppKGoau6xAbu9vWTd/54cPHSYonqcWedt6Be6Q2vNvoIBeEU6/f8PxZFd',s:[0x0b26cfa671,0xc3cdc3aa0e],u:'/cdn-cgi/challenge-platform/h/b'};var now=Date.now()/1000,offset=14400,ts=''+(Math.floor(now)-Math.floor(now%offset)),_cpo=document.createElement('script');_cpo.nonce='',_cpo.src='/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts='+ts,document.getElementsByTagName('head')[0].appendChild(_cpo);";var _0xh = document.createElement('iframe');_0xh.height = 1;_0xh.width = 1;_0xh.style.position = 'absolute';_0xh.style.top = 0;_0xh.style.left = 0;_0xh.style.border = 'none';_0xh.style.visibility = 'hidden';document.body.appendChild(_0xh);function handler() {var _0xi = _0xh.contentDocument || _0xh.contentWindow.document;if (_0xi) {var _0xj = _0xi.createElement('script');_0xj.nonce = '';_0xj.innerHTML = js;_0xi.getElementsByTagName('head')[0].appendChild(_0xj);}}if (document.readyState !== 'loading') {handler();} else if (window.addEventListener) {document.addEventListener('DOMContentLoaded', handler);} else {var prev = document.onreadystatechange || function () {};document.onreadystatechange = function (e) {prev(e);if (document.readyState !== 'loading') {document.onreadystatechange = prev;handler();}};}})();</script></body>

</html>